Analysis
-
max time kernel
56s -
max time network
117s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-07-2021 18:26
Static task
static1
Behavioral task
behavioral1
Sample
New Order_R43YZIr0C8E62iK.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
New Order_R43YZIr0C8E62iK.exe
Resource
win10v20210410
General
-
Target
New Order_R43YZIr0C8E62iK.exe
-
Size
291KB
-
MD5
c2defdcd91b04ece9e34bee77d0f5adc
-
SHA1
14b0616035e2fef2c4dc9ab4ba9b5f23b159c361
-
SHA256
344411537546f4601fe7f667f8cd82cb0aa92da98581ea055b66d49ed16ebd89
-
SHA512
41665255975bf4a392f50455b7640e77e42ee1aa505a60fa4d5b620d9ce4193832362d6159193319a0029109f6602b0ef7f78fbf20de667f773efd67b5e08c25
Malware Config
Extracted
warzonerat
185.105.236.179:1975
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2080-116-0x0000000000405887-mapping.dmp warzonerat behavioral2/memory/2080-117-0x0000000000800000-0x000000000081D000-memory.dmp warzonerat behavioral2/memory/2080-122-0x0000000000800000-0x000000000081D000-memory.dmp warzonerat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
New Order_R43YZIr0C8E62iK.exedescription pid process target process PID 3036 set thread context of 2080 3036 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1848 2080 WerFault.exe New Order_R43YZIr0C8E62iK.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
New Order_R43YZIr0C8E62iK.exeWerFault.exepid process 3036 New Order_R43YZIr0C8E62iK.exe 3036 New Order_R43YZIr0C8E62iK.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
New Order_R43YZIr0C8E62iK.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3036 New Order_R43YZIr0C8E62iK.exe Token: SeRestorePrivilege 1848 WerFault.exe Token: SeBackupPrivilege 1848 WerFault.exe Token: SeDebugPrivilege 1848 WerFault.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
New Order_R43YZIr0C8E62iK.exedescription pid process target process PID 3036 wrote to memory of 2080 3036 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3036 wrote to memory of 2080 3036 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3036 wrote to memory of 2080 3036 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3036 wrote to memory of 2080 3036 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3036 wrote to memory of 2080 3036 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3036 wrote to memory of 2080 3036 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3036 wrote to memory of 2080 3036 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3036 wrote to memory of 2080 3036 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3036 wrote to memory of 2080 3036 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3036 wrote to memory of 2080 3036 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3036 wrote to memory of 2080 3036 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order_R43YZIr0C8E62iK.exe"C:\Users\Admin\AppData\Local\Temp\New Order_R43YZIr0C8E62iK.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Order_R43YZIr0C8E62iK.exe"C:\Users\Admin\AppData\Local\Temp\New Order_R43YZIr0C8E62iK.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 5323⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2080-115-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2080-116-0x0000000000405887-mapping.dmp
-
memory/2080-117-0x0000000000800000-0x000000000081D000-memory.dmpFilesize
116KB
-
memory/2080-122-0x0000000000800000-0x000000000081D000-memory.dmpFilesize
116KB
-
memory/3036-114-0x00000000024D0000-0x00000000024D1000-memory.dmpFilesize
4KB